Corbado Backend API

Name: Corbado Backend API API
Brand: Corbado Backend API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthAuthenticationbasic45 EndpointsREST

For Agents

Manage passkey-based authentication on the Corbado backend, including users, sessions, WebAuthn challenges, identifiers and SSO connections.

Quickstart

Get started with Corbado Backend API in minutes using your preferred integration method.

# Add to your MCP client config (Claude Desktop, Cursor, Windsurf)
{
  "jentic": {
    "url": "https://api.jentic.com/mcp",
    "auth": "oauth"
  }
}

# Then ask your agent:
"create a Corbado user and start passkey registration"

# → Jentic returns the GET /events tool with parameter schema, agent executes.

Capabilities

What an agent can do with Corbado Backend API API.

Create or update a user record and attach login identifiers like email or username

Issue a WebAuthn challenge and update its state during a passkey ceremony

List and revoke passkeys registered to a specific user

Generate connect tokens that the frontend uses for passkey-mediated transactions

GET STARTED

Start building with Corbado Backend API API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for Corbado Backend API, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for Corbado Backend API, keeping it validated and agent-ready. Corbado provides a passkey-first authentication backend that lets applications register users, issue WebAuthn challenges, manage passkeys and connect tokens, and query auth and passkey events for security analytics. The 45 endpoints cover users, sessions, identifiers, passkeys, SSO, project configuration, webhook endpoints and password manager hints, plus device and client environment tracking. The API uses HTTP Basic authentication where the username is the Corbado project ID and the password is the API secret.

Use Cases

Patterns agents use Corbado Backend API API for, with concrete tasks.

★ Passwordless Sign-Up Flow

Consumer apps replacing passwords with passkeys can wire sign-up to Corbado by creating a user and attaching an identifier (email or username), then issuing a passkey registration challenge. POST /users creates the account, POST /users/{userID}/identifiers attaches the email, and POST /users/{userID}/challenges drives the WebAuthn ceremony.

POST /users with email 'jane@example.com', POST /users/{userID}/identifiers attaching the email, then POST /users/{userID}/challenges to start passkey registration.

Step-Up Authentication for Sensitive Actions

Fintech and health apps that need step-up auth before transfers or record changes can use Corbado connect tokens. The backend creates a connect token tied to the user and action, the frontend prompts a passkey ceremony, and a returned challenge result confirms the user authorised the operation before it executes.

Create a connect token for user 'usr_123' tied to 'wire-transfer-9999' and return the token to the frontend for the WebAuthn step-up flow.

Auth Analytics and Suspicious-Login Triage

Security teams can query Corbado's auth events and passkey events to investigate suspicious sign-ins, list per-user passkeys, and revoke compromised credentials. Combined with the device tracking endpoints this gives a per-user authentication footprint for triage.

List passkey events for user 'usr_456' over the last 30 days, then DELETE the passkey ID flagged as registered from an unfamiliar device.

AI Agent Identity Operations

An admin-side AI agent can answer support tickets like 'remove the lost passkey from my account' by calling Corbado through Jentic. The agent searches by intent, loads the schema for passkey deletion, and executes against the matching path while Jentic keeps the project-id and API secret in the credential vault.

Use Jentic to list passkeys for the user, identify the one matching the device the user reported lost, and DELETE it.

Key Endpoints

45 endpoints — jentic publishes the only available openapi specification for corbado backend api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/users

Create a new user

GET

/users

List users

GET

/users/{userID}

Retrieve a user

PATCH

/users/{userID}

Update a user

POST

/users/{userID}/challenges

Create a passkey challenge for a user

POST

/users/{userID}/identifiers

Attach a login identifier to a user

DELETE

/users/{userID}

Delete a user

POST

/users

Create a new user

GET

/users

List users

GET

/users/{userID}

Retrieve a user

PATCH

/users/{userID}

Update a user

POST

/users/{userID}/challenges

Create a passkey challenge for a user

POST

/users/{userID}/identifiers

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Corbado Basic auth combines the project ID with the API secret. Jentic stores both in the credential vault and constructs the Basic header at execution time, so neither value is exposed in agent reasoning context and per-project credentials stay isolated.

Intent-based discovery

Agents search Jentic with intents like 'create Corbado user' or 'revoke passkey' and Jentic returns the matching path under /v2 plus the request body schema, mapping passkey, challenge and identifier sub-resources to the correct user-scoped operation.

Time to first call

Direct integration: 3-5 days to wire up user creation, WebAuthn challenge state machine, identifier handling and webhook receivers. Through Jentic: under an hour from signup to first user created.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Alternative

Auth0 API

Broader identity platform with passwords, social login and passkeys

Choose Auth0 when the app still needs password and social login alongside passkeys, or wants enterprise SSO out of the box.

Alternative

Okta API

Enterprise identity provider with passkey support and workforce-grade SSO

Pick Okta for workforce identity scenarios and large enterprises rather than consumer-app passkey rollouts.

Alternative

Stytch API

Developer-first auth provider with passkeys, magic links and SMS OTP

Choose Stytch when the app wants passkeys plus magic links or SMS as fallback auth methods.

FAQs

Specific to using Corbado Backend API API through Jentic.

Why is there no official OpenAPI spec for Corbado Backend API?

Corbado does not publish an OpenAPI specification at this URL. Jentic generates and maintains this spec so that AI agents and developers can call Corbado Backend API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Corbado Backend API use?

The backend API uses HTTP Basic authentication. The username is the Corbado project ID and the password is the API secret. Jentic stores the project ID and secret in the credential vault and constructs the Basic header at execution time.

Can I register a passkey for a new user with the Corbado Backend API?

Yes. Create the user with POST /users, attach an identifier with POST /users/{userID}/identifiers, then drive the WebAuthn registration ceremony with POST /users/{userID}/challenges and PATCH /users/{userID}/challenges/{challengeID} to update the challenge state.

How do I revoke a passkey on the Corbado Backend API?

DELETE the passkey resource for the user (under the Passkeys tag in the spec). For audit context, list PasskeyEvents for the same user first to confirm which credential was used from the suspicious device before revoking.

What rate limits apply to the Corbado Backend API?

The OpenAPI spec does not declare formal rate limits. Treat WebAuthn challenge endpoints as user-driven (one per ceremony) and back off on HTTP 429 with exponential delay during bulk operations.

How do I create a Corbado user through Jentic with the Corbado Backend API?

Run pip install jentic, search Jentic with 'create Corbado user', load the operation schema for POST /users and execute it with the user's email or username; the project ID and API secret are injected by Jentic from the vault.